1

I'm using spring-boot-starter-web to create a war app that is deployed on a standalone tomcat8.

I have @EnableWebSecurity to force basic-authentication on each servlet request, and also to secure the gui.

But the main purpose is providing a webservice XML, that is mainly accessed programmatically. Thus, the clients send their GET requests always with basic-auth.

Problem: tomcat will create a new session for each request! And as the clients connect programmatically to the xml servlets, the sessions are never logged-out. And also not reused as the next client request will again transmit the basic-auth.

So those sessions reside in the tomcat until timeout (eg default 30mins). And consume memory meanwhile.

Question: how can I tell tomcat or the spring-servlets that connections providing the basic-auth http header don't need to create a session? Just authenticate the user, send the response and forget about session infomration?

membersound
  • 81,582
  • 193
  • 585
  • 1,120
  • https://stackoverflow.com/questions/2255814/can-i-turn-off-the-httpsession-in-web-xml – StanislavL Aug 22 '17 at 14:38
  • If you mean the use of `SessionCreationPolicy.STATELESS`: how can I apply this to specific path only, and leave eg the `/gui` path stateful? – membersound Aug 22 '17 at 14:47

2 Answers2

1

You can set the session creation policy to SessionCreationPolicy.STATELESS

Spring Security will never create an HttpSession and it will never use it to obtain the SecurityContext

Set it in your WebSecurityConfiguration such as:

http.antMatcher("/api/**")
              .sessionManagement()
              .sessionCreationPolicy(SessionCreationPolicy.STATELESS);
Ortomala Lokni
  • 56,620
  • 24
  • 188
  • 240
0

SessionCreationPolicy.NEVER is the correct answer here. Because it won't create a session by default. But if a session is requested (eg due to a form login in my /gui path), it will be used.

This way, none of the programmatic requests create a session. But if tested inside a webbrowser (and thus secured by a form login to provide basic-auth), the session is created. Which is the desired behavior because nobody wants to enter the basic-auth credentials each time when sending a request from within a browser.

http.sessionManagement().sessionCreationPolicy(SessionCreationPolicy.NEVER);

membersound
  • 81,582
  • 193
  • 585
  • 1,120
  • 1
    Nice that you find a session creation policy working for all your cases but you can also apply different policies on different set of endpoints with something such as `http.antMatcher("/api/**").sessionManagement().sessionCreationPolicy(.....)`. – Ortomala Lokni Aug 23 '17 at 18:59